ucast.upm.edu.my ~ Shell I

Editing file /var/www/flag.php (0775)

<?php

///////////////////////////////////////////////////////////////////////////////////////
// PHPmotion                                                http://www.phpmotion.com //
///////////////////////////////////////////////////////////////////////////////////////
// License: You are not to sell or distribute this software without permission       //
// Main Author: Brian Shawa -  bshawa@gmail.com                                      //
// Help and support please visit http://www.phpmotion.com                            //
// Copyright reserved                                                                //
///////////////////////////////////////////////////////////////////////////////////////

include_once ("classes/config.php");

include_once ('classes/sessions.php');

$referer = mysql_real_escape_string($_SERVER['HTTP_REFERER']);
$today_date = mysql_real_escape_string($config["date_format"]);
$flag_video_id = mysql_real_escape_string($_GET['abuse']);
//check if viewer is logged in as a member
if ($user_id == "") {
    @mysql_close();
    error_redirect(113);//"You need to be logged in. Please login or register."
}

//if no id in url
if ($flag_video_id == "") {
    @mysql_close();
    header("Location: " . "$referer");
    die();

}

//check if user has not flagged this before
$flag_sql = "SELECT * FROM flagging WHERE video_id = $flag_video_id AND user_id = $user_id AND flag_type = 'abuse'";
$flag_query = @mysql_query($flag_sql);
$flag_count = @mysql_num_rows($flag_query);
if ($flag_count != 0) {
    @mysql_close();
    error_redirect(114);//"Thank you for your feedback, however our records show you have already flagged this item. "
}
else {

$flag_sql = "INSERT INTO flagging (user_id, video_id, today_date, flag_type) VALUES ($user_id, $flag_video_id, '$today_date', 'abuse' )";
    $flag_query = @mysql_query($flag_sql);
    @mysql_close();
    error_redirect(115);//"The item has now been flaged for our attention. Thank you for your feedback"
}